REMARKS 



In the Official Action mailed on 18 June 2008, the Examiner reviewed 
claims I, 3-5, 7, 8, 10-12, 14, 15, 17-19, and 21. Examiner rejected claims 3-5, 7, 
10-12, 14, 17-19, and 21 under 35 U.S.C. § 1 12. Examiner rejected claims 1, 3-5, 
7-8, 10-12, 14-15, 17-19, and 21 under 35 U.S.C. § 103(a) based on Chaudhuri et 
al. (U.S. Patent No. 7,194,451, hereinafter "Chaudhuri"), and Sin Yeung Lee 
( "Learning Fingerprints for a Database Intrusion Detection System", 2002, 
hereinafter "Lee"). 

Rejections under 35 U.S.C. $ 112 

Examiner rejected claims 3-5, 7, 10-12, 14, 17-19, and 21. Applicant has 
amended the independent claims to overcome the antecedent-basis rejection. No 
new matter has been added. 

Rejections under 35 U.S.C. § 103(a) 

Examiner rejected claims 1, 3-5, 7-8, 10-12, 14-15, 17-19, and 21 under 
35 U.S.C. § 103(a) based on Chaudhuri and Lee. Applicant wishes to point out 
the following distinctions between embodiments of the present invention and 
Chaudhuri as well as Lee: 

First of all, the query signature in the present invention comprises textual 
SQL keywords and operands without literals (see paragraphs [0038-0039] of the 
instant application) and is extracted from the query itself. In contrast, the 
signature in Chaudhuri is an integer derived from and then assigned to a query 
(see Chaudhuri col. 7, line 61 - col. 8, line 2; and col. 4, line 62-col. 5, line 5). 
Moreover, Chaudhury teaches matching two queries by a brute-force text-based 
string comparison, which does not differentiate SQL keywords from literals in a 
query (see Chaudhuri col. 7, lines 54-60). The present invention, on the contrary, 
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generates a signature based on the SQL keywords with literals removed. 
Furthermore, the Chaudhury system groups queries with the same signatures for 
performance comparisons (see Chaudhuri col. 5, lines 3-5). The present 
invention, on the other hand, uses query signatures to determine invalid queries of 
SQL injection (see paragraphs [0038]-[0040] of the instant application). 

Furthermore, Applicant wishes to point out that the fingerprint generation 
method disclosed by Lee is fundamentally different from embodiments of the 
present invention. The SQL injection detection system in the present invention 
produces a signature for a database query by retaining the textual SQL keywords 
contained in the query, and removing the field names and values in the query. 
Therefore, the signature in the present invention specifies a structure based on 
operations within the query and is independent of the field names and values in 
the query. However, the fingerprint disclosed by Lee is generated by selectively 
replacing only field values, but not field names, in a query with tokens, hence is 
not independent of the field names in the SQL query (see Lee Section 2.2, page 
267-268, especially, the presence of field names "custid" and "amt" in the 
fingerprint). 

Accordingly, Applicant has amended independent claims 1, 8, and 15 to 
clarify that the query signature in the present invention includes the text of SQL 
keywords and operands without any field name and value. These amendments 
find support in paragraphs [0038-0040] of the instant application. No new matter 
has been added. 

Hence, Applicant respectfully submits that independent claims 1, 8 and 15 
as presently amended are in condition for allowance. Applicant also submits that 
claims 3-7, which depend upon claim 1, claims 10-14, which depend upon claim 
8, and claims 17-21, which depend upon claim 15, are for the same reasons in 
condition for allowance and for reasons of the unique combinations recited in 
such claims. 
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CONCLUSION 

It is submitted that the present application is presently in form for 
allowance. Such action is respectfully requested. 

Respectfully submitted, 



By /Shun Yao / 

Shun Yao 

Registration No. 59,242 
Date: 1 8 September 2008 

Shun Yao 

Park, Vaughan & Fleming LLP 
2820 Fifth Street 
Davis, CA 95618-7759 
Tel: (530) 759-1667 
Fax: (530) 759-1665 
Email: shunfa parklcgal.com 
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